[CLSA-2026:1794325745] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 15:49:20 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python39_3.9.23-36_amd64.deb
    sha:9a46be280018dc5d28020a49a0cbc6c7a4783921
  • alt-python39-debug_3.9.23-36_amd64.deb
    sha:1fbacbb9c26750db7613f778bc6cb5cbe15fc1b1
  • alt-python39-devel_3.9.23-36_amd64.deb
    sha:2d23f5168dbc9ad0b5e051c81ece8c75892ab384
  • alt-python39-idle_3.9.23-36_amd64.deb
    sha:9b8258a70df5e8dece46db1ccae6cbb5ac0b92cf
  • alt-python39-libs_3.9.23-36_amd64.deb
    sha:f41edf3f1ced0f3a04f28e247c5a357da9ee9705
  • alt-python39-test_3.9.23-36_amd64.deb
    sha:1799d5e241ab632fc20bb98a487ce09141c1e8a3
  • alt-python39-tkinter_3.9.23-36_amd64.deb
    sha:244df72573444da44f93849a4b14add9255e5132
  • alt-python39_3.9.23-36_arm64.deb
    sha:556f967d080991b39b9e7aaf192851acf624f25c
  • alt-python39-debug_3.9.23-36_arm64.deb
    sha:e0b099a6134ce5c21986a14fcd42ad1cb4834c86
  • alt-python39-devel_3.9.23-36_arm64.deb
    sha:ab66fb822bbaf53ef3fd27935219fc8686259a40
  • alt-python39-idle_3.9.23-36_arm64.deb
    sha:7934898b560cb5769515c2a0bd9d50a742ffea25
  • alt-python39-libs_3.9.23-36_arm64.deb
    sha:a6187915b54ae8140ef84040aeabf1c933315c08
  • alt-python39-test_3.9.23-36_arm64.deb
    sha:9074a3f0f4edcd4267cc935296f7366ca4a09009
  • alt-python39-tkinter_3.9.23-36_arm64.deb
    sha:5d35162ad80ad2999d15f653d8eab04c8dd0aa9a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.